Configuring netbotz 250 rack access using snmp or ftp config

[psharp]

Hello,
I'm wondering if there is a way to configure [RackAccessUsers] on a netbotz250 using something like SNMP v1 or v3 write+ or loading a full configuration over FTP with the correct rack access.  

I've been trying to integrate rack access with internal IAM tooling, but it seems like the only way onboard a user is by having someone manually badge a door then converting an unregistered user to a registered one. This is not a great system a scale, across multiple datacenters and multiple locations. It also does not work well with offboarding users upon separation and actually breaks policy on user offboarding 
 
I've run into issue with both our instances of DCE 7.9.0 and a demo of 9.1.2 where updating rack access configuration through DCE does not get written to the device. It attempts to write the config change (which looks like via FTP and not SNMP) but comes back with `incomplete configuration` and the existing rack users access continues to exist. 

I run into the same issue when I load a rendered config over FTP the RackAccessUsers section rebuilds on it's own. There is, as best I can tell, no way to do it via SSH/CLI. When I SNMP walk the device I don't see rack access options. Hoping to get some insight on how I might be able to set these from an outside source that's integratable with our iam platform.

[Cory_McDonald]

Hello @psharp,

The NetBotz 250 uses a config.ini file to house its configuration and these rack access options are not available for configuration via SNMP.  The config.ini file can be download, updated, and restored back to the device for configuration changes.  Instructions on making changes within the config.ini file can be found in our FAQs: https://www.se.com/us/en/faqs/FA156117/

As for the issue that you mention, it could be related to how the config.ini is processed.  Depending on the order of the entries in the config.ini file and the ones already on the device, some entries may not process as the unique identifiers could be found in a different entry already in the device.  I have found that you may need to push a "blanking template" first to clear out rack access entries, and then push the full rack access user config set to the device to ensure that you don't run into this issue.

I don't have a device to test with, but I would try the following to see if it works, either from DCE or outside of DCE via the config.ini file:
- Pull a config.ini file from the device as a backup.  Within DCE, create a template from the device using the APC SNMP device configuration option as a backup

- Push a configuration to clear out all entries in the rack access user section (Leave them checked, but value is blank)

- Confirm on the device that there are no rack access users defined / assigned

- Push a configuration from DCE to the device, including the new user or after removing a user

- Confirm that the configuration is as expected

Kind Regards,

Cory

[psharp]

Thank you @Cory_McDonald 
I will try to push a config that deletes the user before pushing one with the updated user list and report back if it works. 

[ATrabert]

we also have a community help center article regarding how to do this via DCE and the format the config.ini expects it in.  

https://community.se.com/t5/DCE-configuration/How-to-manage-NetBotz-250-rack-access-users-in-the-DCE...